Ransomware Surge Led by Lockbit and Conti Offshoots
July sees a resurgence in ransomware attacks, with Lockbit and Conti offshoots dominating the landscape.
Key points
- Lockbit led 62 ransomware attacks in July 2023.
- Hiveleaks and BlackBasta, Conti offshoots, saw significant activity increases.
- July 2023 witnessed a 47% increase in ransomware campaigns over June.
Ransomware attacks are on the rise again, with old groups like Lockbit leading the charge. According to data from NCC Group, July saw Lockbit involved in 62 attacks, a notable increase from previous months. Lockbit is a ransomware-as-a-service (RaaS) group, which means they rent out their malicious software that locks files until a ransom is paid.
Lockbit's activity in July was more than double the combined total of the second and third most active groups, Hiveleaks and BlackBasta. Hiveleaks was behind 27 attacks, while BlackBasta accounted for 24. These groups are both tied to Conti, a former major player in the ransomware world.
The data suggests July 2023 marked a 47% rise in successful ransomware campaigns compared to June, with 198 in total. Despite this increase, the numbers remain below the peak from earlier in the year.
How did the hackers get in?
The rise in attacks may be linked to structural changes among ransomware groups. In May, the U.S. government offered $15 million for information on Conti, which at the time was the leading ransomware gang. This pressure likely forced Conti to reorganize, resulting in new groups like Hiveleaks and BlackBasta.
These groups have filled the gap left by Conti, showing how quickly the criminal landscape can adapt. As Conti split, its influence seeped back into the scene under new names, swiftly regaining ground.
For ordinary people, the impact of such attacks can mean disruptions in services or potential exposure of personal information. If your data is involved, watching for suspicious activity on your accounts can be crucial.
The NCC Group's findings indicate that ransomware remains a significant threat, with established groups adapting and continuing their operations under new identities. As August approaches, further increases in these activities could be on the horizon.
